mshtml: Fixed use after free in HTMLElement_destructor.

873619e9 · Jacek Caban · Alexandre Julliard · eaa6a9fd · 873619e9
Commit 873619e9 authored Mar 02, 2011 by Jacek Caban Committed by Alexandre Julliard Mar 03, 2011
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 1 deletion

htmlelem.c dlls/mshtml/htmlelem.c +4 -1

No files found.
--- a/dlls/mshtml/htmlelem.c
+++ b/dlls/mshtml/htmlelem.c
@@ -1649,7 +1649,10 @@ void HTMLElement_destructor(HTMLDOMNode *iface)
    HTMLElement *This = impl_from_HTMLDOMNode(iface);
    HTMLDOMAttribute *attr;

-    LIST_FOR_EACH_ENTRY(attr, &This->attrs, HTMLDOMAttribute, entry) {
+    while(!list_empty(&This->attrs)) {
+        attr = LIST_ENTRY(list_head(&This->attrs), HTMLDOMAttribute, entry);
+
+        list_remove(&attr->entry);
        attr->elem = NULL;
        IHTMLDOMAttribute_Release(&attr->IHTMLDOMAttribute_iface);
    }